Privacy policy
I want you to know what happens to the details you share with me. Here I explain what I collect when you use plantsonpeople.art, write to me, sign up for the newsletter, shop in the online shop or buy a Broderiringen package: why, how long I keep it, and what your rights are under the Norwegian Personal Data Act and the General Data Protection Regulation (GDPR).
Last updated: 31 October 2026.
Who is responsible?
The data controller is Plants on People Justyna Skowronek, a sole proprietorship (enkeltpersonforetak), organisation number 826 526 882.
- Address: Østreheimsveien 34, 0590 Oslo, Norway
- E-mail: post@plantsonpeople.art
If you have questions about privacy, or want to use your rights, please e-mail me.
This policy covers details collected on the website, and details you give me by e-mail or on paper in connection with courses and workshops.
Contact forms and requests
What: What you write in the form:
- The contact form: your name, e-mail address, what your enquiry is about (a course or private lesson, a collaboration or something else) and your message.
- The group form: also the kind of group, and if you fill them in, the number of participants, the group's embroidery experience, the place, the preferred date, your phone number and organisation.
- A request for a place in Broderiringen: the package you'd like, the dates that suit you, your name, e-mail address and an optional message.
Together with the message, the site stores that you ticked the consent box, when you did so, which version of the consent text you agreed to and in which language. You get an automatic e-mail confirming that your message has arrived.
Why: To reply to you, send you an offer, or check which places are free and confirm your place in Broderiringen.
Legal basis: The consent you give by ticking the box in the form (GDPR Art. 6(1)(a)). When you ask for an offer or a place in Broderiringen, the processing is also necessary to take steps at your request before entering into a contract (Art. 6(1)(b)). You need to give your name and e-mail address for me to reply; fields marked optional can be left empty.
How long: The message is sent to my e-mail and also stored in the website's admin area, so that no enquiry gets lost. In both places it is deleted after 12 months. In the admin area this happens automatically, and the same goes for the contact record (name and e-mail address) once you have not written to me for 12 months. Your IP address and browser details are not stored with the message. If your enquiry becomes an agreement, such as a workshop for your group, I keep what the agreement and payment need for as long as the agreement lasts, and accounting records for five years, as the Norwegian Bookkeeping Act requires.
Newsletter
What: Your e-mail address, the language you signed up in, and when you agreed to which version of the consent text.
Why: To send you the newsletter and the free pattern.
Legal basis: Your consent (Art. 6(1)(a)). Sign-up uses double opt-in: you are only subscribed once you have clicked the link in the confirmation e-mail.
Where: The newsletter is sent with MailerLite. The form on the website does not send your IP address to MailerLite, but when you click the confirmation link, MailerLite records the time and your IP address as proof of your consent. MailerLite also records whether the newsletters are opened and whether their links are clicked, so I can see what readers find useful.
If MailerLite cannot be reached at the moment you sign up, your sign-up (e-mail address, language and time of consent) is held on the website for a short while and sent again. It is deleted once delivered, and after 30 days at the latest.
How long: Until you unsubscribe, which you can do at any time with the link at the bottom of every e-mail. After you unsubscribe, your address stays in MailerLite marked as unsubscribed, so you don't get the newsletter again by mistake. If you want the address deleted completely, write to me.
The shop
What: Your name, address, e-mail address, phone number if you give it, what you bought, any notes on the order, and the payment and delivery status. If you buy a digital pattern, the site also stores that you agreed to delivery straight away and confirmed that you then lose the right of withdrawal. You can shop without an account, or choose to create one at checkout.
Why: To process and send your order, answer questions and complaints, and meet my bookkeeping obligations.
Legal basis: Our contract (Art. 6(1)(b)) and a legal obligation under the Norwegian Bookkeeping Act (Art. 6(1)(c)).
Payment: You pay with Vipps MobilePay. The payment is processed by Vipps MobilePay, and I never see your card or account details.
Shipping: Your name, address, e-mail address and phone number are shared with the carrier (Posten, or Helthjem when they deliver the parcel), so the parcel can be delivered and you can be notified about it.
How long: Orders that count as accounting records are kept for five years after the end of the financial year, as the Bookkeeping Act requires. Orders that are never paid, and cancelled or failed orders, are deleted automatically within two months. If you created an account, it stays until you ask me to delete it; orders that count as accounting records are still kept for five years.
Broderiringen packages
What: When you buy a Broderiringen package: your name, e-mail address, country, phone number if you give it, the package you bought, the dates you would like if you write them, and the payment status. I don't ask for your address.
Why: To confirm your place and dates and send you practical information. You get the atelier's address in the order confirmation e-mail once the payment has gone through.
Legal basis and how long: As for the shop: our contract (Art. 6(1)(b)) and the Bookkeeping Act (Art. 6(1)(c)). The dates you wrote stay with the order and are deleted with it.
Spam protection
The forms and the newsletter sign-up are protected by Cloudflare Turnstile. Turnstile checks that a person is sending the form, and in doing so processes your IP address and technical details about your browser and device. To stop repeated submissions, the website keeps a one-way hashed version of your IP address (it cannot be turned back into the IP address) for ten minutes.
On the newsletter form, Turnstile only loads once you start filling in the form, not when you open the page.
Legal basis: My legitimate interest in keeping the forms free from spam and abuse (Art. 6(1)(f)).
Statistics (Google Analytics)
I use Google Analytics 4 to see which pages are read, but only if you say yes in the cookie banner. If you say no, Google Analytics is not loaded and no statistics cookies are set. Advertising and personalisation features are always switched off, and Google Analytics 4 does not store your IP address.
Legal basis: Your consent (Art. 6(1)(a)). You can change your choice at any time via "Cookie settings" at the bottom of the page. If you withdraw your consent, measuring stops straight away and the statistics cookies are deleted from your browser.
How long: Statistics data about individual visits is deleted from Google Analytics after 2 months.
Server logs
When you visit the website, the host records technical logs: including your IP address, the time, the page you asked for, the page you came from and your browser type. The logs are only used to run and secure the website, for example to find errors and stop attacks, not to follow individual visitors. The host deletes them on a rolling basis.
Legal basis: My legitimate interest in a secure, working website (Art. 6(1)(f)).
The website has no comment fields.
Who processes data for me?
These providers process data on my behalf (data processors), under a data processing agreement:
| Provider | What they do |
|---|---|
| The web host | Hosting the website, storage and server logs |
| The e-mail provider | My e-mail and the e-mails the website sends |
| MailerLite (UAB MailerLite, Lithuania) | Newsletter |
| Google (Google Ireland Ltd.) | Statistics, only with your consent |
| Cloudflare | Spam protection (Turnstile) |
Vipps MobilePay AS (payment), Posten Norge AS and Helthjem (shipping) are controllers in their own right for the data they process to carry out the payment and the delivery.
Google and Cloudflare may transfer data to the USA. Both are certified under the EU–US Data Privacy Framework, which the European Commission has approved as a valid basis for transfers. If another provider transfers data outside the EEA, it does so on a valid legal basis, such as the EU Standard Contractual Clauses.
I never sell your data, and I don't use it for advertising.
Cookies
The first time you visit the website, the cookie banner asks what I may use. The cookies are in two categories:
- Necessary cookies are always on. Without them the basket, the checkout, logging in and the language choice don't work, and the site can't remember your choice. They are never used to follow you.
- Statistics (Google Analytics) stays off until you say yes.
You can choose "Accept all", "Reject all" or "Let me choose", where you turn each category on or off. Your choice is stored in the pop_consent cookie for 6 months; after that, or if the categories change, I ask again. You can change or withdraw your choice at any time via "Cookie settings" at the bottom of the page. If you withdraw your consent to statistics, measuring stops straight away and the Google Analytics cookies are deleted.
| Name | Purpose | Category | Duration | Set by |
|---|---|---|---|---|
pop_consent | Remembers your cookie choice | Necessary | 6 months | Plants on People |
pll_language | Remembers the language of the page you are reading | Necessary | Until the browser closes | Plants on People |
wp_woocommerce_session_* | Keeps your basket | Necessary | 2 days, 7 days when logged in | Plants on People |
woocommerce_cart_hash, woocommerce_items_in_cart | Tell the site that your basket has changed | Necessary | Until the browser closes | Plants on People |
storeApiCartData, storeApiCartHash, storeApiNonce | Keep the basket and checkout pages in step with your basket (stored in the browser, not a cookie) | Necessary | Until the basket is emptied or the browser data is cleared | Plants on People |
wordpress_logged_in_*, wordpress_sec_*, wordpress_test_cookie | Keep you logged in to your account | Necessary | Until the browser closes, or 14 days with "Remember me" | Plants on People |
wp-settings-* | Admin-area preferences, only for me and any staff | Necessary | 1 year | Plants on People |
_lscache_vary | Makes sure a logged-in visitor or a full basket never gets a stored page meant for someone else | Necessary | Until the browser closes | Plants on People |
_ga | Google Analytics: tells visits apart with a random number | Statistics, only after consent | 6 months | |
_ga_<ID> | Google Analytics: keeps track of the current visit | Statistics, only after consent | 6 months |
When you pay, Vipps MobilePay may set its own cookies on its pages; Vipps MobilePay's privacy policy applies to those. You can also delete or block cookies in your browser. The website works without statistics cookies.
Children
The shop and the newsletter are not aimed at children, and I don't knowingly collect data about children under 13. If you believe your child has given me personal data, please get in touch and I will delete it.
Your rights
You have the right to:
- access the data I hold about you,
- have incorrect or incomplete data corrected,
- have your data deleted,
- restrict the processing,
- object to processing based on legitimate interest,
- receive your data in a structured, machine-readable format (data portability),
- withdraw your consent at any time, without affecting the processing that took place before you withdrew it.
Write to post@plantsonpeople.art. I will reply within one month. Some data I cannot delete before its time is up, such as accounting records the Bookkeeping Act requires me to keep. I don't use your data for automated decisions or profiling.
Complaints
If you believe I am processing your data unlawfully, you can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no). Please contact me first, and we will try to sort it out together.
Changes
If I change how data is handled, I will update this page and the date at the top. For significant changes to the newsletter, I will ask for your consent again.